False positive - Incomplete string escaping
- Langage dominant
- CodeQL
- Étoiles
- 10.1k
- Forks
- 2.1k
- Merge moyen
- 2 j 15 h
- PR mergées (30 j)
- 141
Description
**Description of the false positive**
```
Incomplete string escaping or encoding
This does not escape backslash characters in the input.
```
```ts
part = `"${part.replace(/"/g, '\\"')}"`;
```
This is intentional,
actual string: `abc\"` -> `"abc\\""`
JS:
```js
'abc\\"' '"abc\\\\""'
```
This code is used in a client library to serialize caller input as-is from list to header value.
```ts
const input = ["a", "b", `\\"`];
const serialized = `a,b,"\\\\""`;
```
**Code samples or links to source code**
https://github.com/smithy-lang/smithy-typescript/blob/d8446cfa3bf6cbcf1187d1ad744ac5a296e442d7/packages/smithy-client/src/quote-header.ts#L8
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Start with the linked packages/smithy-client/src/quote-header.ts example and inspect the CodeQL finding that flags its string escaping. Reproduce the report with the provided inputs, then identify the relevant query coverage; done means intentional backslashes in this serialization are no longer reported as incomplete escaping.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- typescript
- Domaine
- security
- Type d'issue
- Bug
- Difficulté
- 3/5
- Temps estimé
- 1-2 jours
- Activité
- À l'abandon
- Clarté
- Plutôt claire
- Accessibilité débutants
- 35/100